Test your agents

Blog

Field notes from the wrong side of an agent's wallet.

September 23, 2026, 4 min read Why a spend cap is not a security layer The x402 client (@x402/core 2.26) ships with a 1 USD default cap per payment. On Base, 98 payments out of 100 fit under it. So does every attack we built. Here is what we measured, and what a real decision looks like.